Query DSL and the Other Query Languages
"Fiction under 20" can be written six different ways against Elasticsearch. That sounds chaotic until you notice each language was built for a different person: an app developer, an analyst, someone typing in a search bar. The main one — and the one this course uses — is the Query DSL.
The rule
Leaf queries test one field; compound queries combine other queries.
The Query DSL (domain-specific language) is JSON sent to _search. Its building blocks come in two kinds:
- Leaf queries look for a value in a single field:
match,term,range,exists,prefix,wildcard,ids. - Compound queries wrap other queries and decide how they combine:
boolis the everyday one; others includeconstant_score,boosting,dis_maxandfunction_score.
GET /books/_search
{
"query": {
"bool": {
"must": [ { "match": { "title": "garden" } } ],
"filter": [ { "range": { "price": { "lt": 20 } } } ]
}
}
}Here bool is compound; match and range are leaves. Any query tree, however large, is leaves at the tips and compounds at the joints.
The same question in the other languages:
- ES|QL — a piped language sent to
POST /_query: startFROM books, then add one step at a time. Built for analysts exploring data. - SQL —
SELECT title FROM books WHERE genre = 'fiction' AND price < 20, sent toPOST /_sql. For people who already know SQL. - KQL —
genre : fiction and price < 20. What you type into Kibana's search bar. - Lucene syntax —
genre:fiction AND price:<20. Used by thequery_stringquery and older tools. - EQL — describes a
sequenceof events, such as a login followed by a download. Built for security work on ordered events over time.
An ES|QL pipeline, one step per line:
FROM books
| WHERE genre == "fiction" AND price < 20
| SORT price
| KEEP title, price
| LIMIT 10The shortcut
Pick the language by who is typing and where: app code → Query DSL; exploring data step by step → ES|QL; Kibana's search bar → KQL; event sequences → EQL. For the DSL itself, ask of every clause "does it test a field, or hold other queries?"
The root
boolholds other queries → compound.
Drills
Answer fast — trust the rule.
Which of these is a compound query?
A security analyst wants "a failed login followed by a password reset on the same account". Which language is designed for that?
What do you type into Kibana's search bar by default?
Which statement about leaf queries is true?
Remember
- Leaf queries test one field; compound queries combine other queries.
- Query DSL for app code, ES|QL for pipelines, KQL in Kibana, EQL for event sequences.
- Every query tree is leaves at the tips and compounds at the joints.